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Abstract. A possible connection between quantum computing and Zeta func- 
tions of finite field equations is described. Inspired by the spectral approach 
to the Riemann conjecture, the assumption is that the zeroes of such Zeta 
functions correspond to the eigenvalues of finite dimensional unitary opera- 
tors of natural quantum mechanical systems. The notion of universal, efficient 
quantum computation is used to model the desired quantum systems. 

Using eigenvalue estimation, such quantum circuits would be able to ap- 
proximately count the number of solutions of finite field equations with an 
accuracy that does not appear to be feasible with a classical computer. For 
certain equations (Fermat hypersurfaces) it is show that one can indeed model 
their Zeta functions with efficient quantum algorithms, which gives some evi- 
dence in favor of the proposal of this article. 
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1. Introduction 

The spectral approach to the Riemann conjecture tries to interpret the zeroes of 
the Riemann zeta function as the eigenvalues of a physical operator, like a Hamil- 
tonian in quantum mechanics. This idea goes back, apparently, to Hilbert and 
Polya, although neither have published about this. Evidence supporting the spec- 
tral interpretation comes from the observed spacing of the zeroes of Riemann's zeta 
function, which has a striking resemblance with the 'eigenvalue repulsion' of chaotic 
quantum mechanical svstems[19j. An explicit construction of an operator whose 
spectrum coincides with the zeroes of £ would show that these roots indeed lie on 
a line, thereby proving Riemann's conjecture. See yQ for an attempt to discover a 
Hamiltonian with such properties. 

In this article we consider a different kind of Zeta functions: those that corre- 
spond to equations over finite fields. Such Zeta functions have a finite number of 
roots, and the corresponding 'Riemann hypothesis' of Andre Weil states that these 
roots lie on a circle in the complex plane. Unlike the case of the Riemann zeta 
function, this hypothesis has been proven. Here we propose to interpret the roots 
of such Zeta functions as eigenvalues of unitary transformations of finite dimen- 
sional quantum systems. More specifically we want these quantum systems to be 
natural, which we will define to mean that they correspond to efficient quantum 
algorithms. By the properties of these Zeta functions, such algorithms would enable 
us to estimate the number of solutions of the equations with an accuracy that does 
not seem to be possible classically. 

Using earlier results on the quantum estimation of Gauss sums, we show that 
for certain diagonal equations, also known as Fermat hypersurfaces" , we can indeed 
construct a corresponding quantum circuit. It is an open problem how to extend 
this result to general hypersurfaces and, ultimately, varieties. 

Notation. Throughout the article we use the following conventions. The number 
of variables X in a polynomial / is n, such that in the affine A™ setting / € 
F[Xi, . . . , X n ] and in the projective case P n we have the homogeneous polynomial 
/ € F[Xo, . . . ,X n ] of degree m. The finite field F has q = p r elements and its 
extensions ¥ q s are indexed by s. The dimension of a variety V is denoted by d, 
such that for hypersurfaces defined by / we have d = n — 1. If an ideal is defined 
by several polynomials /, then the number of polynomials will be t. The variable 
of a zeta function £ is z, while those of Zeta functions Z will be T. 

2. Quantum Computing 

In this Section we briefly describe the basic ingredients of the theory of quantum 
computation. See ^3 or [IB! f° r a thorough introduction to this field. 

2.1. Quantum States and Quantum Transformations. A quantum state if) of 
n quantum bits (qubits) is described by a 2™ dimensional complex valued vector, 
which represents a superposition over all possible n bit strings {0, 1}". In the 
'bra-ket' notation this is expressed as 

x6{0,l}" 

with a x £ C and the normalization restriction ^ x \a x \ 2 = 1. When observing this 
state ip in the computational basis {0, 1}™, the probability of observing a specific 
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string x € {0,1}™ is \a x \ 2 (hence the normalization restriction). In general, the 
probability of observing the state <fi when performing a measurement on ip is the 
'inner product squared' |(0| , 0)| 2 . 

A coherent quantum mechanical transformation T can always be described by 
a linear transformation that preserves the normalization restriction of the state 
vectors. Thus the transformation T of an n qubit system can be represented as 
a 2™ x 2™ dimensional unitary matrix: T £ U(2"). Any such transformation is 
reversible as ■ T = I. A fc-qubit quantum gate G is a unitary transformation of 
k qubits, such that G £ U(2 fc ). 

2.2. Efficient Quantum Algorithms. A quantum circuit C £ U(2 ra ) on n qubits 
can be defined as sequence of 2 qubit gates (note that this includes single qubit 
gates and the two-qubit SWAP operation for the wiring of the circuit). The outcome 
of a circuit on a given input string x £ {0, 1}™ is the probability distribution of the 
output state C\x) over the computational basis states {0, 1}™. The depth of such 
a circuit equals its time complexity and we consider a family of circuits efficient if 
its depth as a function of n is upper bounded by 0(poly(logn)). 

Almost all quantum algorithms known to date rely on the properties and the 
efficiency of the quantum Fourier transform. 

Definition 1 (Efficient Quantum Fourier Transformation). For a ring Z/mZ, the 
quantum Fourier transformation F is defined as the unitary mapping 

m— 1 

F:\x) £ u %\ y ), 

with uj m := c 27ri /«\ 

For a finite field ¥ p r the corresponding quantum Fourier transformation is defined 

by 

V1 ye¥ pr 

for every x £ F p r, where we used the trace function Tr : ¥ p r — > F p defined by 
Tr(ir) :=x + xP-\ h/"'. 

It is well-known that both quantum Fourier transforms can be implemented 
efficiently on a quantum computer (with circuit depth poly(logn) and poly(logp r ) 
respectively [5] El 121)- This fact is an important ingredient of the efficient quantum 
algorithms for factoring and the discrete logarithm problem 23 . 

2.3. Universality of Efficient Quantum Computation. An important aspect 
of the theory of efficient quantum computation is that it is independent of the com- 
putational model one uses. Just as with the classical theory of polynomial-time 
computation, it does not matter if one expresses it in terms of Turing machines, 
circuits, or in any other reasonable model. This universality is proven by, for ex- 
ample, the fact that a quantum Turing machine can efficiently simulate a quantum 
circuit and vice-versa. Furthermore we have the modern Church- Turing thesis, 
which says that the physical resources that are required to solve a computational 
problem are properly quantified by the space/time complexity of the problem in 
the abstract quantum Turing machine model. Again, see ^jJEI f° r more details. 



QUANTUM COMPUTING AND ZEROES OF ZETA FUNCTIONS 



5 



3. Zeta Functions of Polynomial Equations in Finite Fields 

3.1. Projective Spaces, Hypersurfaces and Varieties. Consider a homoge- 
neous polynomial / £ ¥ q [Xo, . . . , X n ] and its solutions obeying f(x) = 0. The 
preferred way of analyzing such a set of solutions is with the use of the projective 
space P n . 

Definition 2 (Projective Spaces). The projective space P"(F) is the set of distinct 
rays x = {(Axo, \x\, . . . , Xx n ) : A £ F x }, excluding the zero-point (0, . . . , 0). If |F| 
is finite, each ray contains |F| — 1 points from the affine space A" +1 (F). This affinc 
space itself has |F|" +1 - 1 non-zero points, hence P"(F) has (|F| n+1 - 1)/(|F| - 1) = 
|F|" + IFI"- 1 H hi elements. 

In algebraic geometry, projective spaces are often preferred over affine ones be- 
cause P™ includes the 'points at infinity' such that it is a closed space. 

By the homogeneity of the polynomial / it follows that if f(xo, . . . , x n ) =0 then 
also /(Axo, ■ • ■ , Xx n ) — for all A. We can therefore group the nontrivial roots of 
/ as rays in P n and hence speak of the set of solutions of f(x) = with x £ P™(F). 

The algebraic closure of ¥ q is denoted by ¥ q , which is the infinite field that 
contains all extensions ¥ q s of ¥ q . For / £ ¥ q [Xo, . . . ,X n ] we want to investigate 
the set of solutions H — {x : x £ P"(F 9 ) and f(x) = 0}, which for obvious reasons 
we will call an (n — l)-dimensional hypersurface. 

We can generalize the notion of a hypersurface by considering the joint solutions 
to several polynomial equations {fi{x) — 0}*. Such an algebraic set is called a 
variety in the context of algebraic geometry and is thus defined by V — {x : x £ 
P"(Fq), fi(x) — 0, . . . , ft(x) = 0}. A variety has a dimension, varieties of dimension 
1 are called curves, and curves that are defined by a single polynomial / are planar 
curves. 

3.2. Zeta Function of a Variety. Given a variety V of a set of polynomials 
{/i, ...,/(}, we can look at the solutions that V has in the finite extensions ¥ q s of 
the finite fields ¥ q . That is, we consider the sizes of the intersections \V nP n (F gS )| 
for s = 1, 2, . . . . This brings us to the following important definition. 

Definition 3 (Zeta Function of a Variety). Let V be a projective variety defined 
over P"(fq) and let N s := \V H P n (F ? »)| for s = Z+. The Zeta function of the 
variety V is the power series Zy(T) £ Q[T] defined by 



Why it is a good idea to define a function like this and why one can call it a 
Zeta function is not entirely trivial. The reader is referred to the appendices in 
this article and the many books and articles that deal with this topic, in order of 
increasing difficulty, m |22 El 1251 OH • For now, we will make do with a few small 
examples. 

3.3. Three Examples of Zeta Functions of Hypersurfaces. 

Example 1 (Zeta Function of a Straight Line). Consider the line L C P 2 (F 9 ) 
defined by f(X , X\, X 2 ) = X\ + X 2 = 0. The solutions to this equation are the 
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rays {(A, 0,0) : A e F x } and {(Xz, A, -A) : A e F x } for every zeF. Hence L has 
1 + |F| solutions, and thus N s = 1 + q s . For the Zeta function Zz, this means 



oc 



Z L (T) = exp 



(l + g s )T 




exp 



(l-T)(l-gT)- 

Clearly every straight line with N s — 1 + q s will have this Zeta function. 

Example 2 (Zeta Function of a 2 Dimensional Hypersurface, Section 11.1 in jlljl. 
Take the_hypersurface H defined by f(X , ...,X 3 ) = -Xg + X\ + Xf + Xf = 
over P 3 (Fy). One can show that for this specific base field F7 we have N s = 
1 + 7 s + (-7) s + 49 s , and thus 

^ (l + 7 s + (-7y + 49 s )T° \ 
Z H (T) = exp h 



(1-T)(1-49T 2 )(1-49T)' 



Example 3 (Zeta Function of a Quartic Diagonal Equation). Let f(Xo, X\, X2) 
Xq + Xf + X2 define a curve C in P 2 (Fs). Its Zeta function equals 

(1-2T + 5T 2 ) 3 



Zc(T) 



(l-T)(l-gT)' 



Note that the roots of the denominator are T — | ± |i. 

The kind of regularity of the above examples holds for all varieties and is ex- 
pressed in the important Weil conjectures 122 EH EH] , which have been proven 
during the period 1949-1973. As a result we now know that Zy(T) is always a 
rational function; but the most important part of the Weil conjectures concerns the 
roots and poles of the Zeta functions. 

3.4. Weil's Riemann Hypothesis. For concreteness, we first describe part of 
Weil's conjecture regarding the Zeta function of curves. 

Theorem 1 (Weil's Riemann Hypothesis for Curves [57]). Let C be a complete, 
nonsingular curve over¥ q . The corresponding Zeta function Zp is a rational func- 
tion £ Z(T) that can be decomposed as 



P{T) 



(l-T)(l-qT) 

n-ii(i-a/o 



(l-T)(l-qTy 

where g is the genus of C. The polynomial P(T) has integer coefficients: P(T) S 
Z[T], and the roots of P(T) can be grouped in pairs (atj, cv-j+g) such that aj = aj+ g . 
Most importantly, the magnitudes of the roots of P(T) obey \otj\ = ^fq for all j . 
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The genus of a curve reflects how different C is from a straight line (which has 
genus 0). This quantity has a close connection with the geometric genus of the 
curve / = when viewed in the projective space P 2 (C). Typically, the genus of a 
curve defined by / is approximately deg(/) 2 . 

Example|21is a typical instances of this theorem: The Zeta function of the curve 
Xq + Xf + X% — in P 2 (F 5 ) has 6 roots, all with norm l/y/E, and when we view 
the equation in the complex projective space in P 2 (C) we see that it has geometric 
genus 3, which corresponds with the fact that its Zeta functions has 2g = 6 roots. 

The most general version of Weil's Riemann hypothesis applies to all 'proper' 
varieties. 

Theorem 2 (Weil's Riemann Hypothesis for Varieties, [57|). Let V be a complete, 
nonsingular algebraic variety of dimension d over¥ q . The corresponding Zeta func- 
tion Zy is a rational function that can be decomposed as 

7 (T] = Pi(T)---P 2d -i{T) 
V[ 1 P (T)P 2 (T)...P 2d (T) 

n£i(i - guv ■ ■ ■ ngr a - ^-^n 

nfii (1 - aojT) nfii (1 - WjT) ■ ■ ■ nf=! (1 - «2 dj T) ' 
where Bi are the Betti numbers of V . All the polynomials Pi(T) are elements 
of Z[T], the roots of the Pi polynomials can be paired such that aij — <5i ! B i /2+j- 
It always holds that Pq{T) = 1 — T and P 2 d,(T) — 1 — q d T, and in general the 
magnitudes of these roots obey \ctij\ = q l l 2 for all i,j. 

As stated before, this theorem has been proven; see [71 151 1171 1221 1251 . 

For hypersurfaces, which are defined by a single polynomial, the Zeta functions 
is particularly simple. Let / 6 F[Xo, ■ ■ ■ ,X n ] be a homogeneous polynomial that 
defines a proper hypersurface H, then its Zeta function has the form 

mi- 1 )" 

y ' h\ ) (l-T)(l-qT)---(l-q n -^Ty 

where each of the [(deg(/) - 1)" +1 - (-l) n (deg(/) - l)]/deg(/) w deg(/) n roots 
of P(T) have magnitude g - ^™ -1 )/ 2 . 

4. Zeroes of Zeta Functions as Eigenvalues of Quantum Circuits 

We want to interpret the roots of Zeta functions of the previous section as the 
spectrum of a quantum mechanical process. This wish is a natural extension of the 
spectral approach to the Riemann conjecture with the added advantage that we 
already have more evidence in favor of it, especially in the case of curves. 

First of all, we know that Weil's Riemann hypothesis is true, hence we know that 
the roots of the Zeta functions all lie on a circle in the complex plane. Second, it 
has also been proven by Katz and Sarnak Ej that for curves the distribution 
of the zeroes of the Zeta functions obeys the kind 'eigenvalue repulsion' that one 
also sees in random quantum mechanical systems. Specifically, they showed that 
for 'generic' curves C in the double limit g — > oo and q — > oo the distribution of the 
zeroes of 1c goes to the eigenvalue distribution of the circular unitary (symplectic) 
ensemble. (See also [T4"].l 

Of course, given a curve C, one can always define a diagonal unitary matrix 
with as its diagonal entries the normalized roots of Zc and declare this matrix to 
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describe a quantum mechanical system. Clearly this is not a satisfactory answer 
because this definition does not give a natural description of a physical system. 
Hence, before we can proceed, we have to find a criterion for what does constitute 
a natural physical system. 

Here we propose to use the class of efficient quantum algorithms to determine if 
a sequence of unitary operations is considered natural or not. Formally, a sequence 
U\, U2, •■■ of unitary matrices with Ui S U(Ni) is natural if and only if there is 
a quantum algorithm that for given i efficiently implements the transformation Ui 
in time 0(poly(log A;)). More concretely, for a variety V we want to describe an 
efficient quantum circuit whose eigenvalues correspond to the phases of the zeroes of 
the Zeta function Zy. The earlier described universality results in Section HOI show 
that this criterion is independent of the specific quantum computational model that 
we use, and the quantum Church- Turing thesis suggests that it captures exactly 
those quantum mechanical systems that can occur in Nature without some kind of 
exponential overhead. 

The next section shows how for so called Fermat hypersurfaces H, which are 
defined by diagonal equations cqX™ + c\X™ + ■ • ■ + c c t+iX t J l ^ 1 = 0, we can indeed 
construct an efficient quantum algorithm that has the normalized roots of Zh as 
its eigenvalues. 

5. Quantum Algorithm for Zeta Functions of Some Hypersurfaces 

For some hypersurfaces H we can express the roots of the corresponding Zeta 
functions Zh in terms of products of Gauss sums. [TTl H6 Before we give the quan- 
tum algorithm whose eigenvalues are these roots, we will repeat some known results 
on the quantum computation of Gauss sums. 

5.1. Multiplicative Characters and Quantum Computing Gauss Sums. A 

multiplicative character of a finite field is a function x : F g ^ C such that x( x u) = 
x( x )x(y) f° r all x iV £ ^ q- Let g be a primitive element of ¥ q , i.e. the multiplicative 
group (g) generated by g equals F* := F g \{0}, and let tu q _ 1 := c 2 ^ 1 /^ 1 ) . For each 

a G {0, 1, ... , q — 2}, the function x(&) '■= u q-i (complemented with x(0) := 0) is a 
multiplicative character. Conversely, every multiplicative character can be written 
as such a function. The discrete logarithm with respect to g is defined for every 
x = g' J G F* by log s (a;) :— j mod (q — 1). Hence, every multiplicative character 

can be expressed as xi x ) '■— w^° Sfl ^ for x ^ and y(0) := 0. 

Fix a generator g and define the primitive multiplicative character x by x( x ) := 
ui q _l ■ For every a £ Z we have the a-th power of x according to x a ( x ) := 
(x( x )) a - Thus the trivial multiplicative character is denoted by x° and is defined 
by x°(0) = and X°( x ) = 1 f° r all x ^ 0. Using the equality x° • X 13 — x a+/3 we see 
that the set of characters {x a '■ ol £ {0, . . . , q — 2}} with pointwise multiplication 
defines a group isomorphic to the additive group Z/ (g— 1)Z. The inverse of x obeys 
X (s) — x( x ) f° r all x, where z denotes the complex conjugate of z. 

Definition 4 (Gauss sums over Finite Fields). For a finite field ¥ q with q = p r 
and a multiplicative character x, we define the complex valued Gauss sum g by 

9(X) ■= X( x )^ {x) , 

x£F q 
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where Tr is the standard trace function. Obviously, g(x°) = — 1 and for nontrivial 
characters x we have that the norm of the Gauss sum obeys \g(x)\ = \M- 

To be a able to quantum compute we use the following states 0|, which were 
also previously described by Watrous in • 

Definition 5 (Chi States). Given a finite field ¥ q and a generator g £ ¥ q we define 
the chi states for every a € Z by 

where x Q refers to the multiplicative character defined by g in x a {g J ) = u q—i- 
Note that |x°) is the uniform superposition of the elements of F* . Chi states can 
be produced in time 0(poly(log q)) on a quantum computer. 0] 

The assumption that multiplication and division in ¥ q can be done efficiently 
implies that, using repeated powering x > x 2 i— » x 4 • • • , we can efficiently calculate 
any power x 3 in ¥ q for — q < j < q. This is a useful operation in combination 
with x states. It is straightforward to check that if we apply the reversible \x, y) i— > 
\x,y/x a ) mapping (for x,y £ ¥ q ) to the superposition |x^)Ix 7 )j then we obtain 
\x l3+ai )\x 1 ) ■ Hence, under the assumption that it is easy to create the uniform 
superposition |% ), we can efficiently create arbitrary \x a ) states from an initial 
state |x). Chi states are especially helpful if we want to induce a phase change 
e that is determined by a Gauss sum g(x) = e l6 y/q of a nontrivial character x- 
For, if we create the state |x) and perform the Fourier transform over F g to it, we 
implement the evolution |x) >— > ff(x)/v / 9' Ix -1 )- See |5J Ej and references therein 
for more detailed information about these topics. 

5.2. Quantum Algorithm for Zeta Functions of Fermat Hypersurfaces. 

With the results of the previous subsection we have the following theorem. 

Theorem 3. Let f be a homogeneous polynomial in ¥ q [Xo, . . . , X n \: 

f(X ,...,X n ) = c X™ + Cl Xr + --- + c n X™, 

with q = 1 mod m, and let H be the corresponding [n — 1)- dimensional projective 
hypersurface H := {x : x £ P"(F q ) and f(x) = 0}. For every such H there exists 
an efficient quantum circuit whose eigenvalues are the roots of the Zeta function 
Z ff . 

Proof. In Chapter 11 of |llj it is explained how the the corresponding Zeta function 
equals 

7 m g(g 

H{ ' (l-T)(l-qT)---(l-q n -^Ty 

where P (and hence Zh) has (m — l)[(m — 1)™ + (— l) n_1 ]/m w m n non-trivial 
zeroes, all on the circle \T\ = g _ ( n_1 )/ 2 . 

Define x to be the character x{g J ) := wj^ 1 ^™, with g a generator of F^ , such 
that x™ = X°- Then, we also know that the roots l/aj of P = Y[j (1 — a jT) are 
described by 

i _ (-I)"" 1 g(xo) ■ ■ ■ g(xn) 



(2) 



<Xj Q n Xo(c ) • • ■Xn(Cn)' 
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where the multiplicative characters are defined by \i := X bi > with b% € {1, . . . , to— 1} 
for all i and J^. 6; = mod to. 

We rewrite the roots as 1/ay = e l8 j / ^/ g n_1 , such that we can focus on the un- 
known angles 9j € [0, 2n). Using the quantum algorithms for Gauss sum estimation 
and multiplicative character phase changing described in Ej j we can implement 
the evolution \bo, . . . , b n ) i— > e l9j \bo, . . . , b n ) for every j and its corresponding se- 
quence (bo, ... , b n ). Hence this evolution has \bo, . . . , b n ) as its eigenstates and the 
normalized roots \J q n ~ 1 /ctj — e 10j as the eigenvalues. □ 

In order to make this theorem more explicit, we describe the quantum algorithm 
(note that the size of the input / is « nlogq bits). 

Algorithm 1. Given the polynomial / of Theorem [3J implement the following 
quantum evolution on a state |&o, ■ ■ ■ , b n ) that obeys bi ^ for all i and '^2 i bi — 
mod to. 

(1) Attach the chi states |x°, x), giving |6 , . . . , b n ) |x°, x)- 

(2) For every < i < n, perform the following steps: 

(a) Apply \x,y) h-> \x,y/x bi ) to |x°,X) such that we get \x b ',X)- 

(b) Apply a Fourier transformation over ¥ q to the x bi register, yielding 
the state g(x H ) / ^ ■ \x^ ,x). 

(c) Again perform \x, y) i— > |x, y/x bi ) to the two chi registers such that the 
net effect of the subroutine is |x°,x) l— * 5(x b ' )/\/9 ' lx°;X)- 

We now have the state g(\o) ■ • • ff(Xn)/ vV +1 1 l & o, • • • , &n) ® |x°,X>- 

(3) For every < i < n, apply the reversible \y) i— > |y ■ c') to the x register. 
This induces the phase change |x) i— > X _&i ( c i)lx) = lx)/Xi( c i)- 

(4) Finally, apply a general phase flip (— l)™ -1 to the state. 

By multiplying the phase changes of the above steps, one sees that this algorithm 
establishes the overall evolution 

6 , . . . ,b n ,x ,x) 1 — > ,—r. f — r^" & o>- x > x), 

v /g n+1 Xo(c ) • • •X«(c„) 

which describes indeed the roots of Equation [21 The time and space complexity of 
the algorithm is 0(n ■ poly (log <?)). □ 



6. Zeta Functions and Approximate Point Counting 

In this section we look at the relevance of Zeta functions to the computational 
task of point counting. Directly from the definition Zy(T) := exp(^ s N S T S / s) it is 
clear that knowledge about Zy implies knowledge about the numbers of solutions 
N s . Note for example that we have Zy(<5) = 1 + N\6 + 0(S 2 ); hence the value of 
first derivative d/dT of Zy(T) at T = answers the question a Ni = ?" 

On the one hand this is good news because counting is a central problem in com- 
putational complexity theory about which we already have many results. On the 
other hand, we know that exact counting very quickly becomes #P-complete (where 
"very quickly" means determining iVi for moderately complicated V) . Because it is 
unlikely that quantum computers can solve #P-complete problems [8], this makes 
it at least as unlikely that we will be able to efficiently determine Zy(T) exactly 
with a quantum algorithm. Fortunately, the proposal in this article concerns the 
design of algorithms that do not try to exactly count the values N s , but rather only 
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try to approximate these quantities. Hence, the hardness of #P-complete problems 
does not directly contradict our spectral approach to Zeta functions. 

6.1. Zeroes of Zeta Functions and Approximate Point Counting. By taking 
the sth derivative d s /dT s at T = of the logarithm of Zy(T), we see, using 
Theorem |2 that for the number of solutions N s of V over the finite field extension 
¥ qS we have 

2d-l Bi 

N s = q ds + i+j2(-iYY, a ir 

i=l 3 = 1 

For a hypersurface H defined by a homogeneous polynomial / G ¥[Xq, X n ], 
where most of the roots otij are trivial, this equation becomes especially simple 
(see Equation QJ: 

sn _ i 

3 

where the summation goes over the w deg(/) ra non-trivial zeroes of Z# , each obey- 
ing a.j '■= y • e l6j . The number of points of an (n — l)-dimensional plane in 
P ra (F gS ) equals the first term (q sn — l)/(q s — 1), hence the aj values express how 
much the number of points of H deviates from those of a straight plane. If we 
assume that we have a unitary transformation Uh whose spectrum consists of the 
e l6j phases, then we can express this deviation as 



N s -^-}- = -(-l)V^lK Tr(^). 
q s — 1 

Hence by estimating the trace of Uh we obtain a non-trivial estimation of the 
number N\ of solutions to the equation / = over ¥ q . 

6.2. Potential Quantum Algorithms for Approximate Counting. Assume 
that we can efficiently implement the unitary transformation Uh of the previous 
subsection. Here, "efficiently" means that the time/space complexity of the im- 
plementation is poly(logg, log(dim(t r _y))) = poly(logq, ralog(deg(/))). Using stan- 
dard phase estimation techniques and 1/e repetitions, this enables us to estimate 
— 1 < Tr (Uh)/ dim({/jj) < 1 with precision e. Overall, this gives an estimate N± 
with expected error 



2Vi - iVi 



V^ rT deg(/)" 



with time/space complexity poly(l/e, logq, n log(deg(/))). 

If one classically (and trivially) samples 1/e times the space P n (F) to estimate 
the number N\, then the estimated error will be ~ q n ■ e, while recent results 
[101 l2*lj indicate that it might be possible to classically count N\ exactly in time 
poly(logg,deg(/) n ). 

This indicates that the conjectured quantum algorithm that uses Uh to approxi- 
mately count N\ would outperform classical computation in the case where deg(/)" 
is exponentially big while deg(/) is smaller than Jq, The algorithm that was de- 
scribed in Theorem|3is an example of such a case if we fix both deg(/) and q with 
deg(/) < y/q. 
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7. Conclusion 

The open problem that remains is obvious: For what other hypersurfaces H 
can we construct quantum circuits with eigenvalues corresponding to the roots of 
the Zeta function Z#(T)? We consider such circuits efficient if the space/time 
complexity is bounded by poly(logg, nlog(deg(/))), where / 6 ¥ q [X , ■ ■ ■ , X n ] is 
the homogeneous polynomial that defines H. In addition, if we want to know 
how useful such quantum circuits are in comparison with classical algorithms, we 
also need to know what the classical complexity is of approximating roots of Zeta 
functions. 

Acknowledgements. I thank Vinay Deolalikar for explaining to me various aspects 
of algebraic geometry and Zeta functions. 
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Appendix A. Varieties and Algebraic Geometry 

In this section I will give a brief overview of the ingredients from commutative 
algebra and algebraic geometry that are necessary to appreciate Weil's Riemann 
conjectures. To make matters a bit easier the definitions are only done in the context 
of afine varieties V over finite fields F. For the definition of the Zeta function we 
only deal with the case when the variety is a planar curve C. This restriction allows 
us to leave out various part of the general theory. 

A.l. Ideals and Varieties. (See [jUGOU^-) An ideal of the ring of polynomials 
F[Xl, . . . , X n ] is a subset 3 C F[Ai, . . . , X n ] such that: 

• o e 3 

• If /, g G 3 then / + g e3 

• If / G 3 and h G ¥[X U ...,X n ] then fh G 3. 

The ideal generated by a finite set of polynomials fx , . . . , ft is the smallest possible 
ideal 3 C F[Xi, . . . , X n ] such that fx, . . . , f t G 3. This ideal equals 

(fx,-.., ft) ■= {fxhx + --- + f t h t :hx,...,h t eW[Xx,...,X n }}. 

Hilbert's basis theorem says that each ideal C F[Ai, . . . , X n ] can be finitely gener- 
ated by a list of polynomials fx,...,ft- 

An afjine variety C A"(F) is defined by the polynomials fx, ■ ■ ■ , ft as the set of 
roots 

V(fx,...,f t ) := {xeA n (W):fx(x)=0,...,f t (x) = 0}. 

For an affine variety V we define the corresponding ideal by 

I(V) := {f e¥[Xx,...,X n ] :f(x) = for alia- G V} . 

The crux of the matter here is that for a given variety V there are many different 
sets of polynomials fx,---,ft such that V = V(/i, ...,f t ), but there is only one 
ideal I(V). Hence when studying V it is often more useful to look at I(V) rather 
than an arbitrary set of polynomials with V = V(/i, . . . , f t ). 
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We start with a few facts about multivariate polynomials over finite fields. Let 
/ € F[Xi, ...,X n }. It is important to realize that "f{X) = for all X e A"(F)" 
does not imply that / = 0. Take for example f{X{) = X\ - X\ for Ii e F 2 . If, 
however, "f(X) = for all X e A"(F )" with F algebraically closed, then indeed 
/ = 0. Similarly, if f(X) ^ for all X e A"(F), then / = c e F x . From 
this it follows that if the variety of a principal ideal (/) C ¥[X\, . . . ,X n ] is a 
subset of A"(F), then V((/)) = A"(F) implies / = 0, and V((/)) = {} implies 
(/) = ¥[Xi, . . . , X n ] (because c € F x generates the whole ring F[Xi, . . . , X n \). 

For any variety V we have V(1(V)) = V. However, another important issue is 
the fact that although • • • , /t) C I(V(/i, . . . , ft)), this inclusion is sometimes 
strict. Consider for example (X 2 ) C I(V(A 2 )) = (X) ^ (X 2 ). Hence for some 
ideals 3 we have I(V(3)) ^ 3. The following is a necessary and sufficient condition 
on 3 such that I(V(3)) = 3. The radical ideal of an ideal 3 is the ideal 

:= {/ : f m e 3 for some m G Z+}. 

The Nullstellensatz says that for all ideals I(V(3)) = V5. Or, in other words: 
I(V(3)) = 3 if and only if 3 is radical. A direct consequence of this "zeroes theorem" 
is that V(3) = {} implies 3 = ¥[X U ...,X n ]. 

A variety V is irreducible if V = V\ U V 2 with Vi and V 2 varieties implies V = V\ 
or V = V 2 . An ideal C F[Ai, . . . ,X n ] is prime if for all fg e with /,.g e 
F[Xi, . . . , X n ] we have / e or g e ^. A variety y is irreducible if and only if the 
ideal 1(V) is prime. Clearly, each prime ideal is radical. 

For the algebraically closed field F with varieties V C A"(F) it also holds that 
for prime ideals *P we have I(V(*P)) = *p. Hence we see that I and V establish a 
bijection between the prime ideals ^ C F[Ai, . . . , X n ] and the irreducible varieties 
V C A"(F). (That this is not true for varieties over finite fields is readily seen 
by «p = (X 2 + X + 1) C ¥ 2 [X] with V(«P) = {} C A 1 (F 2 ) and hence I(V(<P)) = 
¥ 2 [X] ^ <p. In the case of varieties C A 1 (F 2 ) we have V(^5) = F 4 \F 2 , and hence 
indeed I(V(«P)) = «p.) For each prime ideal <£, the quotient ring F[X U X n }/<# 
is an integral domain, which is a commutative ring with a "1" and without zero- 
divisors. 

A. 2. Addition and Multiplication of Ideals. One can add and multiply ideals 
3,£ C R according to 3 + £ := {/ + <? : / e 3,g e £} and 3 ■ £ := : /, G 

J, gt G £}, where is a finite summation. Both constructions are again ideals 
with the inclusions 3£C3,£C3 + £. The corresponding varieties obey the rules: 
V(3 + £) = V(3) n V(£) and V(3 • £) = V(3) U V(£). The zero ideal is {0}, while 
the unit ideal is (1) = F[A X , ...,X n ]. 

A. 3. Coordinate Ring of a Planar Curve. Let / e ¥[X, Y] define a planar 
curve such that (/) is a prime ideal and let C := V((/)) C A 2 (F) be the corre- 
sponding irreducible variety. Let F[C] := ¥[X,Y]/(f) be the commutative coordi- 
nate ring of polynomials on the curve C. Because (/) is prime, ¥[C] is an integral 
domain, which means that gh = implies g = or h = in ¥[C]. In fact, the 
commutative ring ¥[C] is a Dedekind ring such that all ideals 3 C F[C] will have a 
unique factorization in terms of prime ideals *p C ¥[C\. 

How do the ideals 3 of ¥[C] look like? Let g e 3 with a point (a, b) e A 2 (F) on 
the curve C such that g(a, b) — 0. Define the Frobenius automorphism (f> : ¥ — > F by 
(j) : z 1— » z q , where q is the size |F| of the base field. It is straightforward to see that 
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</> is indeed an automorphism with <fi(x + y) = 4>(x) + <fi(y) and 4>{xy) = <j>(x)<j>(y) for 
all x, y e F. The rth power <ff is defined by <jf{z) := z^ qV \ such that <f> r acts as the 
identity on ¥ q r. Let (f>(a,b) denote the point (<f>(a) , <j>(b)) . Because g <G ¥[X, Y] we 
see that g(a, b) = implies g((j) r (a, b)) = for r = Z + . Let d be the degree of the 
point (a, 6), which means that d is the smallest integer such that (a, b) G A 2 (F g d). 
Then c/> d (a, 6) = (a, 6) and the orbit {a , b) := {(a, 6), </>(a, 6), </> 2 (a, 6), . . . , <j> d ~ l {a, b )} 
consists of d different points in A 2 (F). Because / <G FLY, Y], all points (j) r (a,b) 
will also lie on the curve C. As a result, g will also be zero on C for all d 
points (a,b),<j>(a,b), . . . ,(p d ~ 1 (a,b). This result extends to the ideals 3 C F[C]: 
for each point (a, 6) e C with (a, 6) € V(3), the whole orbit lies in the variety: 
{(a,6),0(a,6),...,^- 1 (a,6)}CVp). 

Conversely, let S C C be a set of points that is closed under the Frobenius 
automorphishm (that is: if (a, b) € S 1 , then <f>{a,b) £ S). It is straightforward to 
check that the set of polynomials {g £ F[C] : <?(a, 6) = for all (a, 6) € S} is an 
ideal in ¥[C]. 

The prime ideals of F[C] are in one-on-one correspondance with unique orbits in 
C. For each orbit 0( Oj 6) C C the ideal I(0( ajb )) is prime, and for each prime ideal 
«P C ¥[C] the variety V(<£) C C is an orbit 6 (0;b) . 

A. 4. Norms in Coordinate Rings. The polynomial / e F[A, F] is absolutely 
irreducible if and only if / is irreducible in ¥[X, Y]. A point (a, b) of the corre- 
sponding curve C is singular if and only if df/dX = df/dY — at (a,b). The 
curve C is nonsingular if and only if it has no singular points. 

If / is absolutely irreducible and the corresponding curve C is nonsingular, then 
we can define a norm on the ideals of ¥[X, Y]/(f) as follows. Let 3 be a non-zero 
ideal, then its norm in the coordinate ring ¥[C] is defined by := |F[C]/3|, which 
will always be a finite number. Recalling the definition of multiplication of ideals, 
one can show that ||3 • £|| = ||3|| • ||£||. For each prime ideal ^P, we have that 
||«P|| = q d where d is the size of the orbit corresponding to ^. 

Appendix B. Why It Is Called a Zeta Function 

Here I will give a brief explanation of the connection between Riemann's zeta 
function and the Zeta function of finite field equations. 

B. l. Riemann's Zeta Function. For z G C with 3?(z) > 1, Riemann's zeta func- 
tion is defined by (r(z) := YlnLi n ~ z ■ For the other z £ C with 3?(z) < 1, the zeta 
function Q{z) is determined by the analytical continuation of the 3t(z) > 1 part of 
the function. This continuation gives explicitly C(z) = {Y^Li (~ l) n_1 /n z )/(l — 
2 1 "*) for n(z) > and C(l - z) = 2{2tt)~ z cos(ztt /2)T{z)Q(z) for 3?(z) < 0. (Com- 
pare this with the function f(z) = X^^Li z ~ n , which is properly defined only for 
\z\ > 1, but which can be continued to the whole z G C plane by the function 
l/(z-l).) 

The Riemann zeta function diverges to +oo as s — > 1 and £(z) = for z = 
—2, —4, —6, . . . (the trivial zeroes). The remaining roots of £ lie in the strip < 
^St(z) < 1. The Riemann conjecture states that all these non-trivial zeroes z are 
in fact on the line 3?(z) = |. Some well-known function values are: £(— 2) = 0, 
C(-l) = C(0) = -\, C(l) = +oo, C(2) = tt 2 /6, C(3) = 1.202056903..., and 

the first non-trivial root C(| ± i • 14.1347 . . . ) = 0. 
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The connection between prime numbers and the zeta function is given by the 
important Euler product 



oo 

«') - E= 



n=l 



n 

p=2,3,5,. 



1 1 



n y 2 ? 



p=2,3,5 

where the product is over all primes p in Z. For example, this shows how the value 
= +oo implies the fact that there is an infinite number of primes in Z. The 
Euler product relies crucially on the fact that each number n = 1,2,3, .. . has a 
unique factorization in terms of the primes p = 2, 3, 5, . . . . 

The ideals of Z are the subsets 91 = nZ with the norm ||91| := |Z/nZ| = n. 
The zeta function is hence defined by C(Z, z) := J2m II^IT 2 = II<p VO- - II^IT 2 ), 
which relies on the unique factorization of each ideal 91 into a sequence of prime 
ideals 



? no-til* n i 



||9t||* 11 l-||qj||-*' 

«ncz 11 11 vpez 1 r " 

B.2. Dedekind Zeta Functions. For number fields K = Q(6) other than Q we 
can extend the notion of a zeta function to that of Dedekind zeta functions. We 
thus get a zeta function for the ring Z^ (like the Gaussian integers Z[i]) that are 
defined similar to the previous equation, except for that the summation (product) 
now ranges over the (prime) ideals 01, *P C Z^. 

Example 4 (Dedekind Zeta Function of Gaussian Integers). Consider the elements 
in the ring Z[i] := {a + bi : a, b e Z}, which is a principal ideal domain with 
units ±1 and ±i. Each ideal (a + bi) can be viewed as a lattice in Z[i] in that is 
spanned by the vectors a + bi and — b + ai, which shows that that we have the norm 
|| (a + 6i)|| := |Z[i]/(a + bi)\ = a 2 + b 2 on the ideals of Z[i]. 

The prime ideals *P C Z[i] are described as follows (see Section 9.7 in 

• $p = (1 +i), with obviously ||«p|| = 2. 

• = (p) with p = 3 mod 4 a prime in Z, such that — p 2 . 

• For each prime p = 1 mod 4 in Z there are two different prime ideals (a + 6i) 
and (a — bi) (determined by a 2 + b 2 = p), such that for both ideals ||^}|| = p. 

Hence the Dedekind zeta function of Z[i] equals 



C(Z[i],z) := I| r 
<pcz[i] 



\-1~ z J-A l-p- 2z 11 <l-p- z ) 2 

p=3,7,ll,... ^ p=5,13,17,... v K ' 

The conjecture that the non-trivial zeroes of zeta functions Of of all such K lie 
on the $t(z) = \ line is known as the extended Riemann hypothesis. 
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B.3. Zeta Functions of Algebraic Varieties. Let / G FLY, Y) be an absolutely 
irreducible function and let C C A 2 (F) be its nonsingular curve. In Section [A. 31 
we mentioned that this implies that the ring F[C] := ¥[X,Y]/ (f) is a Dedckind 
domain with hnite quotients. This means that the nontrivial ideals J C F[C] have 
a unique factorization 3 — *Pi ■ • ■ Cp s into the prime ideals ^3^ of F[C] . Furthermore, 
for each nonzero ideal the norm := |F[C]/3| will be a finite integer. 
We can now define the zeta function of F[C] by 

mC],z) := 

where we sum over all non-zero ideals of F[C]. Because of the unique factorization 
property of F[C], we can rewrite the zeta function according to the Euler product 



C(¥[C],z) = III 



-www 



with the product over all prime ideals of F[C]. 

As mentioned in Section fA.3l each prime ideal *P corresponds to an orbit 0( ,6) = 
{(a, 6), 0(a, 6), . . . , d_1 (a, b)} of <i points in C, where d is the degree of the point 
(a, b). The norm of such a prime ideal equals ||Cp|| = q d . Let 6^ be the number of 
ideals that have norm q d and define Z(F[C], q~ z ) ■= C(F[C], z) in combination with 
the substitution T <— <? -2 , then 



z(F[c*],r) = J[{i-T d y 



d=l 

Taking the natural logarithm of this infinite product gives the following summation 



log(Z(F[C],T)) = -][>log(l-T d ) 



d=l 

By looking at fixed powers T s , we can rewrite this summation as 

oo j, s 

log(Z(F[C],T)) = SE^l- 

s=l rf|s 

Now, to count the number of points := CnA 2 (F g »), we add all orbits that have 
coefficients in ¥ q s. Because a degree d orbit lies in K 2 (¥ q s) if and only if d\s (as 
F q d C Fq 3 if and only if d\s), we see that N s — J2d\s dbd- Going back to the Zeta 
function, we thus have 

(3) Z(¥[C],T) = 

for C C A 2 (F) a nonsingular curve defined by a completely irreducible polynomial 
/ € F[A, Y"]. Note however that — with a leap of faith — Equation [21 can also be 
used to define a Zeta function Z(F[F],T) for general affine varieties V C A"(F) or 
projective varieties V C P"(F). 
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B.4. Connection Between Local and Global Zeta Functions. For each prime 
field Z/pZ we say that £(Z/pZ, z) — 1/(1 — p~ z ) for the following reason. Consider 
Z/pZ = ¥ p [X]/{X) where X = has one solution (N s = 1) for all fields F pS . Using 
the definition of the Zeta function for varieties, we find that Z(F p ,T) = 1/(1 — T) 
for all p, and hence indeed C(F P , z) = 1/(1 —p~ z ). Observe now that we can recover 
the Riemann zeta function (defined for Z) by the product 

ccz,*) = n c(w,z), 

p=2,3,5,... 

over all primes p. We say that the global Riemann zeta function over Z is composed 
by the local zeta functions over Z/pZ. The next example for the Gaussian integers 
Z[i] indicates that this is no coincidence. 

Example 5 (Local and Global Zeta Functions of Gaussian Integers). Because 
Z[i] = Z[X]/(X 2 + 1), we look at the zeta functions of the equation X 2 = —1 for 
the various base fields F p : 

• p = 2: The equation X 2 = —1 has one solution, hence C(^2[X]/ (X 2 + 
l),z) = l/(l-2-*). 

• p 2 and p = 1 mod 4: The equation X 2 = —1 has two solutions in F p3 , 
hence ({F p [X}/{X 2 + 1), z) = 1/(1 - p~ z ) 2 . 

• p ^ 2 and p = 3 mod 4: The equation X 2 = — 1 in ¥ p s has no solution if s 
is odd, and it has two solutions if s is even. Hence (using N s = 1 + (— l) s ) 
we have C(F p [X]/(X 2 + 1), z) = 1/(1 - p" 22 ). 

Altogether, this gives the product 



n c(F P [x]/ ( x 2 +i),z) = n n-Ui n 

;2,3,5,... "-sis ^ V ) „— i 7 ^ 

ich coi 
ample 0] 



p=2,3,5,... p=5,13,... v ^ ; p=3,7,... 

which corresponds exactly with the zeta function of Z[i] = r L\X\j(X 2 + 1) in Ex- 
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